Date: Wed, 7 Dec 2011 09:53:57 +0100
From: Martijn Broos <martijn.broos@...xion.com>
To: Gage Bystrom <themadichib0d@...il.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: distributing passwords to users

Ok, You have been harsh enough on the poor solution the user is going to choose.
Are you willing to give him some advise or directions where he should go to?

A textbook sentence I always learned was: You can burn a person with many words, it is better to help him with few in the right direction!

If he doesn't know what he is doing wrong, then how do you think he will learn to do it right the next time. He is clearly asking for advise.

Are there standard solutions for managing passwords which need to be used by many users and securing them without telling the real password to the user who needs one to impersonate as another user?

Kind regards,

Martijn


From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Gage Bystrom
Sent: woensdag 7 december 2011 9:38
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] distributing passwords to users


O.o and you act like what he wants is a good thing? Getting /any/ service account with that file would be better than pillaging an entire server of ssh keys. With ssh keys you know you only got access to a few more servers on the network, maybe not even root or admin unless you got lucky and score the key used for root/admin for every single box. No, with that you score the entire clientele...

Not to mention what you described is not what he is asking. He wants to distribute the passwords to multiple users(idc if they are hashed, encrypted or not, just minor details at this point). What you described is a centralized database. There's only one copy of the file, only one server that holds the goods, the rest can have tidbits and if compromised can do minimum damage. Coupled with the right motivations and logging then attacking the support group on the internal network gives you almost nothing.

Conversely attacking a single user holding the password file for the OP is end game. You're simply not going to be able to secure multiple copies of the same file with different access controls(hey I used a textbook phrase :) ).

The only alternative is to have one access control, or all users have the same permission. However that is also absurd, you're only multiplying your attack service with each added user.

Maybe now ya see where I start wondering where the cognitive dissonance ought to be coming in for attempting what the OP is trying to do? I was wrong for assuming it should be obvious from the get go, but as you can see the ISP wasn't in the same boat he wants to board. They would be sitting in the crows nest wondering why the loonie on the deserted island was trying to paddle it home.

Alright, I think I've been harsh enough on the poor OP, but I hope he understands that this is a classic case of "You're doing it wrong". He knows what needs to be done, but his method of doing so actively works against his goal.
On Dec 6, 2011 10:51 PM, "James Condron" <james@...o-internet.org.uk<mailto:james@...o-internet.org.uk>> wrote:
An ISP I worked at stored logins for customer servers where the customer required us to be able to login to provide support.

We used a webapp on our internal network with the relevant security accoutrements. Its pretty standard; you login, find the server you need credentials for and hit a button to either launch a putty session or an RDP session. You can also edit passwords or view for non-windows users.

The reason tools exist is because there is a demand for them- hell, its a password safe. Perhaps OP should look at this type of solution.

On Wed, Dec 7, 2011 at 6:28 AM, Gage Bystrom <themadichib0d@...il.com<mailto:themadichib0d@...il.com>> wrote:
I'm disturbed in the first place that you want to distribute password
lists to multiple users.
I'm disturbed more so that there is no apparent cognitive dissonance
preventing you from functioning enough to have sent that email.

Someone please tell me that I'm not the only one disturbed here? And
if I am, point to me why please?

On Mon, Dec 5, 2011 at 7:30 PM, G V <gvasiliu@...il.com<mailto:gvasiliu@...il.com>> wrote:
> Hi,
>
> From your experience, what's the best secure and easy way to update a
> password list and distribute it to 1000 or so unix users? The users
> would have different privilege levels and different access on network.
> Throwing ideas, I can think of: pgp (difficult to maintain a separate
> file for each user), web app (would need to be sucured over ssl,
> possible password protected), usb disks (difficult to manage changes).
> Anyone using an enterprise level app (commercial or not) to "share"
> passwords to users, manage changes and so on? Any other ideas I can
> use?
>
> Thank you,
> George Vasiliu
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


________________________________

DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it.
Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists